PagerDuty v2

Use the PagerDuty integration to manage schedules and on-call users.
This integration was integrated and tested with PagerDuty API v2.

Configure PagerDuty v2 on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for PagerDuty v2.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   API Key		False
   Service Key (for triggering, acknowledging and resolving events only)		False
   Trust any certificate (not secure)		False
   Use system proxy settings		False
   Fetch incidents		False
   Incident type		False
   Initial Fetch Interval (In minutes, used only for first fetch or after Reset last run)		False
   Default requestor ID for adding people to incidents		False
   Maximum number of incidents per fetch	The maximum number of incidents to retrieve per fetch cycle. Hard upper limit is 200.	False
   Incident statuses to fetch	The statuses of PagerDuty incidents to ingest. Include “resolved” to capture short-lived incidents.	False

4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

By default, the integration will import PagerDuty incidents data as Cortex XSOAR incidents. All incidents created in the minute prior to the configuration of Fetch Incidents and up to current time will be imported.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

1. Get all schedules: PagerDuty-get-all-schedules
2. Get information for on-call users by time or schedule: PagerDuty-get-users-on-call
3. Get information for current on-call users: PagerDuty-get-users-on-call-now
4. Get incidents: PagerDuty-incidents
5. Create a new event/incident: PagerDuty-submit-event
6. Get the contact methods of a user: PagerDuty-get-contact-methods
7. Get a user’s notification rules: PagerDuty-get-users-notification
8. Resolve an event: PagerDuty-resolve-event
9. Acknowledge an event: PagerDuty-acknowledge-event
10. Get incident information: PagerDuty-get-incident-data
11. Get service keys for each configured service: PagerDuty-get-service-keys
12. Add responder to an incident: PagerDuty-add-responders
13. Run response play to an incident: PagerDuty-run-response-play

PagerDuty-get-all-schedules

Receive all schedules from PagerDuty.

Base Command

PagerDuty-get-all-schedules

Input

Context Output

Command Example

#### Context Example

```json
{
    "PagerDuty": {
        "Schedules": [
            {
                "escalation_policies": [
                    {
                        "id": "someid",
                        "name": "Default"
                    }
                ],
                "id": "scheduleid",
                "name": "New Schedule #1",
                "time_zone": "America/Los_Angeles",
                "today": "2021-03-10"
            },
            {
                "escalation_policies": [
                    {
                        "id": "anotherid",
                        "name": "test policy"
                    }
                ],
                "id": "anotherscheduleid",
                "name": "New Schedule #2",
                "time_zone": "Europe/Athens",
                "today": "2021-03-10"
            }
        ]
    }
}

Human Readable Output

All Schedules

ID	Name	Today	Time Zone	Escalation Policy	Escalation Policy ID
scheduleid	New Schedule #1	2021-03-10	America/Los_Angeles	Default	someid
anotherscheduleid	New Schedule #2	2021-03-10	Europe/Athens	test policy	anotherid

PagerDuty-get-users-on-call

Returns the names and details of on call users at a certain time or by specific schedule.

Base Command

PagerDuty-get-users-on-call

Input

Context Output

Command Example

!PagerDuty-get-users-on-call scheduleID=scheduleid

Context Example

{
    "PagerDutyUser": [
        {
            "DisplayName": "Demisto User",
            "Email": "demisto@demisto.com",
            "ID": "someid",
            "Role": "owner",
            "TimeZone": "Europe/Athens",
            "Username": "Demisto User"
        },
        {
            "DisplayName": "Another User",
            "Email": "demisto@gmail.com",
            "ID": "anotherid",
            "Role": "user",
            "TimeZone": "Europe/Athens",
            "Username": "Another User"
        }
    ]
}

Human Readable Output

Users On Call

ID	Email	Name	Role	User Url	Time Zone
someid	demisto@demisto.com	Demisto User	owner	https://demisto.pagerduty.com/users/someid	Europe/Athens
anotherid	demisto@mail.com	Another User	user	https://demisto.pagerduty.com/users/anotherid	Europe/Athens

PagerDuty-get-users-on-call-now

Returns the names and details of current on call personnel.

Base Command

PagerDuty-get-users-on-call-now

Input

Context Output

Command Example

#### Context Example

```json
{
    "PagerDutyUser": [
        {
            "DisplayName": "Demisto User",
            "Email": "demisto@demisto.com",
            "ID": "someid",
            "Role": "owner",
            "TimeZone": "Europe/Athens",
            "Username": "Demisto User"
        }
    ]
}

Human Readable Output

Users On Call Now

ID	Email	Name	Role	User Url	Time Zone
someid	demisto@demisto.com	Demisto User	owner	https://demisto.pagerduty.com/users/someid	Europe/Athens

PagerDuty-incidents

Shows incidents in PagerDuty. Default status parameters are triggered,acknowledged.

Base Command

PagerDuty-incidents

Input

Context Output

Command Example

#### Context Example

```json
{
    "PagerDuty": {
        "Incidents": [
            {
                "Description": {
                    "description": "No description"
                },
                "ID": "someid",
                "Status": "acknowledged",
                "Title": "[#264] Ticket 01439490",
                "acknowledgement": {
                    "acknowledger": "someone",
                    "acknowledgerId": "ABC123",
                    "time": "2021-03-04T08:53:04Z"
                },
                "assignee": "someone",
                "assignment": {
                    "assignee": "someone",
                    "assigneeId": "ABC123",
                    "time": "2021-03-04T08:53:04Z"
                },
                "created_at": "2021-03-04T08:52:56Z",
                "escalation_policy": "Default",
                "incident_key": null,
                "last_status_change_at": "2021-03-04T08:53:04Z",
                "last_status_change_by": "someone",
                "number_of_escalations": null,
                "resolve_reason": "",
                "resolved_by": "someone",
                "service_id": "P5CX6RZ",
                "service_name": "PD SF",
                "teams": [],
                "urgency": "high"
            },
            {
                "Description": {
                    "description": "No description"
                },
                "ID": "anotherid",
                "Status": "triggered",
                "Title": "[#278] my event",
                "acknowledgement": {},
                "assignee": "someone-else",
                "assignment": {
                    "assignee": "someone-else",
                    "assigneeId": "ABC123",
                    "time": "2021-03-10T08:37:17Z"
                },
                "created_at": "2021-03-10T07:57:16Z",
                "escalation_policy": "Default",
                "incident_key": "somekey",
                "last_status_change_at": "2021-03-10T08:37:17Z",
                "last_status_change_by": "API Service",
                "number_of_escalations": null,
                "resolve_reason": "",
                "resolved_by": "someone-else",
                "service_id": "someid",
                "service_name": "API Service",
                "teams": [],
                "urgency": "high"
            }
        ]
    }
}

Human Readable Output

PagerDuty Incidents

ID	Title	Description	Status	Created On	Urgency	Html Url	Incident key	Assigned To User	Service ID	Service Name	Escalation Policy	Last Status Change On	Last Status Change By	Resolved By User
someid	[#264] Ticket 01439490	description: No description	acknowledged	2021-03-04T08:52:56Z	high	https://demisto.pagerduty.com/incidents/someid		someone	P5CX6RZ	PD SF	Default	2021-03-04T08:53:04Z	someone	-
anotherid	[#278] my event	description: No description	triggered	2021-03-10T07:57:16Z	high	https://demisto.pagerduty.com/incidents/anotherid	somekey	someone-else	someid	API Service	Default	2021-03-10T08:37:17Z	API Service	-

PagerDuty-submit-event

Creates a new event/incident in PagerDuty(In order to use this command you have to enter the Service Key in the integration settings).

Base Command

PagerDuty-submit-event

Input

Context Output

Command Example

!PagerDuty-submit-event action=trigger severity=info source=demisto summary="my new event"

Human Readable Output

Incident key	Message	Status
somekey	Event processed	success

PagerDuty-get-contact-methods

Get the contact methods of a given user.

Base Command

PagerDuty-get-contact-methods

Input

Context Output

Command Example

!PagerDuty-get-contact-methods UserID=someid

Context Example

{
    "PagerDuty": {
        "Contact_methods": [
            {
                "email": "demisto@demisto.com",
                "html_url": null,
                "id": "someotherid",
                "label": "Default",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/someotherid",
                "send_html_email": false,
                "send_short_email": false,
                "summary": "Default",
                "type": "email_contact_method"
            },
            {
                "blacklisted": false,
                "html_url": null,
                "id": "someid",
                "label": "Mobile",
                "phone": "000000",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/someid",
                "summary": "Mobile",
                "type": "phone_contact_method"
            },
            {
                "blacklisted": false,
                "enabled": true,
                "html_url": null,
                "id": "onemoreid",
                "label": "Mobile",
                "phone": "0000000",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/onemoreid",
                "summary": "Mobile",
                "type": "sms_contact_method"
            }
        ]
    }
}

Human Readable Output

Contact Methods

ID	Type	Details
someotherid	Email	demisto@demisto.com
someid	Phone	0000000
onemoreid	SMS	000000

PagerDuty-get-users-notification

Get the users notification rules.

Base Command

PagerDuty-get-users-notification

Input

Context Output

Command Example

!PagerDuty-get-users-notification UserID=someid

Context Example

{
    "PagerDuty": {
        "Notification_rules": {
            "contact_method": {
                "address": "demisto@demisto.com",
                "html_url": null,
                "id": "someotherid",
                "label": "Default",
                "self": "https://api.pagerduty.com/users/someid/contact_methods/someotherid",
                "send_html_email": false,
                "send_short_email": false,
                "summary": "Default",
                "type": "email_contact_method"
            },
            "html_url": null,
            "id": "someid",
            "self": "https://api.pagerduty.com/users/someid/notification_rules/someid",
            "start_delay_in_minutes": 0,
            "summary": "0 minutes: channel someotherid",
            "type": "assignment_notification_rule",
            "urgency": "high"
        }
    }
}

Human Readable Output

User notification rules

ID	Type	Urgency	Notification timeout(minutes)
someid	assignment_notification_rule	high	0

PagerDuty-resolve-event

Resolves an existing event in PagerDuty.

Base Command

PagerDuty-resolve-event

Input

Context Output

Command Example

!PagerDuty-resolve-event incident_key=somekey serviceKey=servicekey

Context Example

{
    "Event": {
        "ID": "somekey"
    },
    "PagerDuty": {
        "Event": {
            "Message": "Event processed",
            "Status": "success",
            "incident_key": "somekey"
        }
    }
}

Human Readable Output

Resolve Event

Incident key	Message	Status
somekey	Event processed	success

PagerDuty-acknowledge-event

Acknowledges an existing event in PagerDuty.

Base Command

PagerDuty-acknowledge-event

Input

Context Output

Command Example

!PagerDuty-acknowledge-event incident_key=somekey serviceKey=servicekey

Context Example

{
    "Event": {
        "ID": "8e42eeb6391a4a2abeda5d12e09bddec"
    },
    "PagerDuty": {
        "Event": {
            "Message": "Event processed",
            "Status": "success",
            "incident_key": "somekey"
        }
    }
}

Human Readable Output

Acknowledge Event

Incident key	Message	Status
somekey	Event processed	success

PagerDuty-get-incident-data

Get data about a incident from PagerDuty.

Base Command

PagerDuty-get-incident-data

Input

Context Output

Command Example

!PagerDuty-get-incident-data incident_id=someid

Context Example

{
    "PagerDuty": {
        "Incidents": {
            "Description": "",
            "ID": "someid",
            "Status": "acknowledged",
            "Title": "[#281] my new event",
            "acknowledgement": {
                "acknowledgerId": "ABC123",
                "acknowledger": "someone",
                "time": "2021-03-10T09:31:48Z"
            },
            "assignee": null,
            "assignment": {
                "assignee": "someone",
                "assigneeId": "ABC123",
                "time": "2021-03-10T09:31:48Z"
            },
            "created_at": "2021-03-10T09:31:48Z",
            "escalation_policy": "Default",
            "incident_key": "somekey",
            "last_status_change_at": "2021-03-10T10:00:50Z",
            "last_status_change_by": "API Service",
            "number_of_escalations": null,
            "resolve_reason": "",
            "resolved_by": null,
            "service_id": "someid",
            "service_name": "API Service",
            "teams": [],
            "urgency": "high"
        }
    }
}

Human Readable Output

PagerDuty Incident

ID	Title	Status	Created On	Urgency	Html Url	Incident key	Service ID	Service Name	Escalation Policy	Last Status Change On	Last Status Change By	Resolved By User
someid	[#281] my new event	acknowledged	2021-03-10T09:31:48Z	high	https://demisto.pagerduty.com/incidents/someid	8e42eeb6391a4a2abeda5d12e09bddec	someid	API Service	Default	2021-03-10T10:00:50Z	API Service	-

PagerDuty-get-service-keys

Get Service keys for each of the services configured in the PagerDuty instance.

Base Command

PagerDuty-get-service-keys

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "PagerDuty": {
        "Service": [
            {
                "CreatedAt": "2016-03-20T14:00:55+02:00",
                "ID": "someid",
                "Integration": [
                    {
                        "Key": "somekey",
                        "Name": "API Service",
                        "Vendor": "Missing Vendor information"
                    }
                ],
                "Name": "API Service",
                "Status": "critical"
            }
        ]
    }
}

Human Readable Output

Service List

ID	Name	Status	Created At	Integration
someid	API Service	critical	2016-03-20T14:00:55+02:00	Name: API Service, Vendor: Missing Vendor information, Key: somekey

PagerDuty-add-responders

Add responders to an incident.

Base Command

PagerDuty-add-responders

Input

Command Example

!PagerDuty-add-responders incident_id=PXP12GZ UserRequests=P09TT3C,PAIXXX Message="Please join zoom meeting"

Context Output

Context Example

{
    "PagerDuty": 
    {
        "ResponderRequests": [
            {
                "ID": "P09TT3C",
                "IncidentID": "PXP12GZ",
                "IncidentSummary": "[#31028] Test Incident for Demisto Integration - No Action",
                "Message": "Please help with issue - join bridge at +1(234)-567-8910",
                "RequesterID": "P09TT3C",
                "ResponderName": "John Doe",
                "ResponderType": "user_reference",
                "Type": "user"
            },
            {
                "ID": "PAIXXX",
                "IncidentID": "PXP12GZ",
                "IncidentSummary": "[#31028] Test Incident for Demisto Integration - No Action",
                "Message": "Please help with issue - join bridge at +1(234)-567-8910",
                "RequesterID": "P09TT3C",
                "ResponderName": "Jane Doe",
                "ResponderType": "user_reference",
                "Type": "user"
            }
        ]
    }
}

PagerDuty-run-response-play

Run a response play on PagerDuty (based on its UUID).

Response Plays are a package of Incident Actions that can be applied during an Incident’s life cycle.

Base Command

PagerDuty-run-response-play

Input

Command Example

!PagerDuty-run-response-play incident_id="Q107XAAAAMBBR" from_email="john.doe@example.com" response_play_uuid="111111-88bb-bb37-181d-11111111110dewsq"

Human Readable Output

Response play successfully run to the incident Q107XAAAAMBBR by john.doe@example.com